Localization of Coordinated Cyber-Physical Attacks in Power Grids Using Moving Target Defense and Machine Learning

Abstract

Coordinated cyber-physical attacks (CCPAs) are dangerously stealthy and have considerable destructive effects against power grids. The problem of stealthy CCPA (SCCPA) localization, specifically identifying disconnected lines in attack, is a nonlinear multi-classification problem. To the best of our knowledge, only one paper has studied the problem; nevertheless, the total number of classifications is not appropriate. In the paper, we propose several methods to solve the problem of SCCPA localization. Firstly, considering the practical constraints and abiding by one of our previous studies, we elaborately determine the total number of classifications and design an approach for generating training and testing datasets. Secondly, we develop two algorithms to solve multiple classifications via the support vector machine (SVM) and random forest (RF), respectively. Similarly, we also present a one-dimensional convolutional neural network (1D-CNN) architecture. Finally, extensive simulations are carried out for IEEE 14-bus, 30-bus, and 118-bus power system, respectively, and we verify the effectiveness of our approaches in solving the problem of SCCPA localization.

1. Introduction

During the process of traditional power systems evolving into smart grids (SGs) in the field of power delivery, management, and maintenance, the desirable convenience may be achieved due to the enormous and advanced devices used. However, some malicious attacks will simultaneously arrive because of stealthy vulnerabilities in SGs. Until now, one type of attack, known as coordinated cyber-physical attacks (CCPAs), has been prevalent. Compared with a standalone attack, e.g., a false data injection attack (FDIA), a CCPA is more dangerous as it is a kind of synchronous attack consisting of a physical attack and a cyber-attack to mask the physical attack. One example was the December 2015 attack on the Ukrainian electrical grid [1]. As a result of this attack, CCPAs have received significant attention [2].

There exists a variety of work on defense against CCPAs. Strategies associated with securing a set of measurements [3] or relying on measurements from known secure phasor measurement units (PMUs) disposed in the grid [4] were proposed. Nevertheless, security upgrades in some devices whose life cycles are several decades long are quite expensive in power grids. Furthermore, it can be inferred that PMUs are vulnerable to FDIAs from extensive research. Machine learning (ML)-based methods have been used to detect malicious attacks [5,6]. However, recent research has confirmed that adversarial scenarios can limit ML-based algorithms’ efficacy [7].

As a result of the imperfect efficacy of existing defense mechanisms, several studies have been based on moving target defense (MTD) technique to detect CCPAs [2,8]. The concept of MTD technology is to invalidate the attacker’s knowledge through actively perturbing the power grid’s line reactance. This can be implemented using distributed flexible AC transmission system (D-FACTS) devices. Without an accurate knowledge of the transmission lines reactance, the attacker cannot launch an undetectable CCPA [3,4]. In the case of the work on MTD defense against attacks, it has largely focused on detecting FDIAs. Among these works, some metrics to design effective MTD were developed [9,10,11], a hidden MTD whose activation can avoid the attacker’s detection was proposed [12], and the cost–benefit trade-off was exposed [10]. When considering the work on MTD defense against CCPAs, the literature [2] proposed optimal D-FACTS device deployment to destroy the construction of CCPAs via a zero-sum game theoretical framework. Abiding by practical constraints, the literature [8] further studied the optimal D-FACTS device deployment. So far, most of the existing studies involved MTD focus on the problem of attack detection only. In contrast, the study of CCPA localization has not received attention.

Actually, the problem of FDIAs localization has become a hot spot [13,14,15,16]; however, the number of similar studies focused on CCPAs is only one [17]. Essentially, the problem of attack localization is a nonlinear multiple classifications problem. Specifically, the problem of CCPA localization is to identify the disconnected lines in the CCPA. After carefully taking the study in the literature [17] into account, we point to two main reasons for this situation. One is that the total number of classifications is not easy to determine. As the system becomes larger, the number of categories becomes larger and larger. For example, for an IEEE 14-bus power system, when supposing that the maximum number of tripped lines is 2, there are 210 categories, while the number is 15,931 for IEEE 118-bus system. The enormous total number of classifications greatly restricts the problem of CCPA localization to be solved. Another is how to formulate the data utilized to solve the problem. Our two previous studies [18,19] appropriately addressed the above two issues. As described in ref. [18], a sophisticated attack will not randomly select his/her target in addition to complying with the practical constraints. This means that the total number of classifications can be simply determined based on the set of transmission lines which are most likely attacked. Effectively, the data are the compromised measurements. In [17], a measurement formula was proposed as follows:

$$z_{\mathit{c}\mathit{c}\mathit{p}\mathit{a}\_\mathit{e}\mathit{x}\mathit{t}\mathit{r}\mathit{a}}^{\prime }={\mathbf{z}}^{\prime }+({\mathbf{H}}^{\prime }\Delta {\mathsf{\theta }}^{\prime }+\mathbf{H}\mathbf{c})+(\Delta {\mathbf{H}}^{\prime }{\mathsf{\theta }}_{\mathit{p}}^{\prime }-\Delta \mathbf{H}{\mathsf{\theta }}_{\mathit{p}})$$

(1)

For simplicity, the implication of each quantity in Formula (1) may be seen in [17]. The representation of Formula (1) is complex, which increases the difficulty of calculation. Correspondingly, the literature [19] also developed a formula to solve the measurements, as follows:

$${\mathbf{z}}_{\mathit{m}\mathit{o}\mathit{c}\mathit{p}\_\mathit{e}\mathit{x}\mathit{t}\mathit{r}\mathit{a}}={\mathbf{H}}_{\mathit{m}}{\mathit{x}}_{\mathit{m}\mathit{p}}+\mathbf{H}\mathbf{c}+\mathit{e}$$

(2)

Similarly, the meaning of each quantity in Formula (2) can be seen in [19]. Obviously, the representation of Formula (2) is much simpler than that of Formula (1). Formula (2) can be used to calculate the measurements.

At the same time, there are a variety of ML-based multi-classification approaches, such as the support vector machine (SVM) [20,21], random forest (RF) [22], and convolutional neural network (CNN) [23], which is one of the dominant neural networks in recent years. After sweeping away the above two obstacles, in this paper, we have solved the problem of CCPA localization based on the above three ML algorithms, respectively.

In brief, the contributions of our work are three-fold.

After transforming the problem of CCPA localization into a multi-classification problem, we present a feasible scheme to determine the total number of classifications based on the subjective consciousness of a smart attacker, which serves as a firm foundation to establish the multi-classification problem.

We develop a method to acquire the full amount of data, owing to an excellent ability to extract features in it. For the above three ML approaches, the quality and scale of the data are both crucial and have a decisive impact on the classification results.

For solving the problem of CCPA localization, we propose three algorithms based on SVM, RF, and CNN, respectively.

The rest of this paper is organized as follows. Section 2 provides the related works. Section 3 reviews theory analysis. The proposed methodology is introduced in Section 4. Case studies are implemented in Section 5. The discussion are presented in Section 6. Section 7 provides the conclusions.

2. Related Works

From the perspective of SG security, the research on attack localization is necessary and valuable. Multiple methods exist to locate FDIAs. In general, these methods can be classified into two categories, known as model-based [24,25,26] and data-driven [13,15,16,27] approaches. The model-based approaches can successfully address FDIA localization by mainly relying on the SG model and appropriate algorithms. Contrarily, data-driven methods do not build a physical system model.

Multiple studies aiming to localize FDIAs have had a positive effect on the localization of CCPAs. Essentially, the problem of attack localization is a multi-classification problem. A variety of ML-based approaches exist that have capacities to cope with multi-classification problems. These include SVM, RF, and CNN. Multiple representative examples associated with conducting several multi-classification problems based on the three methods are listed in

Table 1. Summary of related works.

Author	Publication Year	Algorithm Used	Main Contributions
Cecilio Angulo et al. [28]	2003	SVM with a “1-1-r” structure	Am SVM, named as KSVCR, was designed based on Vapnik’s support vector theory.
Qiu Tang et al. [29]	2020	KSVM	An optimized S-transform (OST) and a kernel SVM (KSVM). Subsequently, a classification framework to detect and classify various PQD signals through integrating OST and KSVM was developed.
Yange Chen et al. [30]	2022	Multi-class SVMs composed of several binary classification SVMs	A privacy-preserving medical diagnosis scheme based on multi-class SVMs and a secure computing protocol to calculate the key process of the SVM classification algorithm.
Salim Rezvani et al. [31]	2023	SVM with a “1-1-r”	The intuitionistic fuzzy twin SVM (IFTSVM) can reduce the negative impact of noise and outliers. A new version of the IFTSVM using relative density information was proposed. Then, all the training points were evaluated using a “1-1-r” strategy to construct the k-class classification hyperplanes.
Shuai Yuan et al. [32]	2022	RF	A multiscale local maximum RF (MSLM-RF) was proposed. The MSLM-RF relied on RF for classification after spectral and spatial features fusion.
Dong Chen et al. [33]	2022	RF	Based on a locally weighted ensemble detection-based adaptive RF(LED-ARF) classifier, a novel OL architecture was proposed [33].
Fei Tong et al. [34]	2022	RF	A spectral–spatial and cascaded multilayer RF(SSCMRF) method was proposed to classify tree species in a high-spatial-resolution hyperspectral image [34]. Two classification stages were adopted to fully exploit the spatial information. By concatenating the output of the superpixel-based classification, two kinds of spatial information were integrated.
Tianxi Wang et al. [35]	2023	RF	A multiscale adaptive-switch RF was proposed. First, the adaptive-switch decision tree was designed to use noise-sensitive features to conduct binary classification [35]. Second, a multiscale RF structure to detect legs at different distances was designed.
Shuyan Li et al. [36]	2020	1D-CNN-LSTM	A 1D-CNN-LSTM model, shaped by fusing 1D-CNN and a long-short term memory (LSTM) network, was designed to better exploit the global information of videos. The model processed long frame sequences in a parallel and hierarchical way and exploited the correlations between frames to reconstruct the frame-level features [36].
Sahar S. Tabrizi et al. [37]	2020	SVM with RBF LSTM 2D-CNN	A comparative study was performed to examine the forehand strokes classification of three ML models in table tennis [37]. The paper studied tuning the models’ parameters and examining sensitivities of the models and type of data.
Dong Xiao et al. [38]	2021	1D-CNN	A deep learning architecture with 1D-CNN was presented for quickly analyzing fluorescence lifetime imaging (FLIM) data. Simultaneously, the reason of selecting the 1D-CNN was thoroughly illustrated.
Shaofei Yang et al. [39]	2022	1D-CNN	A robust and efficient star identification algorithm utilizing 1D-CNN was proposed. Moreover, a combined star points selection strategy technique and a mixed initial features extraction technique were presented.
Shailesh Mohine et al. [40]	2022	1D-CNN-BiLSTM	An acoustic modality-based hybrid deep 1D-CNN-bidirectional LSTM technique for moving vehicle classification was proposed. The high-level features sequentially detected from experimentally generated vehicles signal were automatically extracted, and these features were kept in the network for analyzing the time-varying characteristic for classification by the presented algorithm.
Fatima Husari et al. [41]	2022	Hybrid HCNN-SVM	For the incipient interturn fault diagnosis of drive-fed machines, a novel two-level hybrid architecture consisting of CNN and SVM was created. The first level of the structure was to identify the pattern of interturn fault, and the second level was developed to recognize the fault severity. The shared layers of HCNN can automatically extract the features, which were suitably used to train the SVM for classification.
Gyuho Lee et al. [42]	2023	1D-CNN	After a sensor was designed to acquire the vibration and magnetic field data of equipment, a 1D CNN was proposed to classify the status of machinery based on the data from the sensor.
Wenliao Du et al. [43]	2023	1D-2D Joint CNN	Combining a 1D-CNN and 2D-CNN can make full use of their advantages. A 1D-2D joint CNN was constructed for rotating machinery fault diagnosis. Specifically, 1D convolution can obtain the multiscale feature vectors of the vibration signal; these feature vectors were transformed into 2D maps, and then these 2D vectors were injected into the 2D CNN.
Yadong Xu et al. [44]	2024	CMFCNN	A cross-modal fusion convolutional neural network (CMFCNN), which adopted two parallel modality-specific networks and a cross-modal knowledge-sharing network was proposed. To achieve effective feature propagation and fusion, a cross-modal fusion module was introduced to integrate cross-modal features and pass the fused information to the next layer [44].

.

Deep Summary of Existing Works

According to the multiple instances provided in Table 1, after deeply analyzing every study, there are three questions related to the problem of CCPA localization. These are how to acquire data, how to determine the total number of multi-classifications, and how to develop algorithms to solve CCPA localization problems using SVM, RF, and CNN approaches, respectively.

After taking the above questions into account, the main innovations can be inferred as follows.

(1)

A method to acquire data is proposed.

We developed a method to acquire data to solve the problem of CCPA localization. For an IEEE 14-bus power system, IEEE 30-bus power system, and IEEE 118-bus power system, we adopt the method and acquire three groups of data, and then verify their performance via the XGBoost algorithm.

(2)

Elaborately determine the total number of multi-classifications.

As mentioned above, even for IEEE 14-bus power system (a small-scale system), the total number is not small. However, for a large-scale system, the number must be huge. This greatly restricts the construction of CNN models. Consequently, the number must be small. Based on the literature [18], the probability of being disconnected for each line in a power grid is different. As a sophisticated attacker aims to keep an attack stealthy and pursue his/her most desirable reward, he/she will attack the lines most likely to be attacked. Simultaneously, the attacker does not attack a “cut” line so as to avoid causing large power flow fluctuations perceived by a system operator. As such, the total number can be perfectly and reasonably reduced via game theory. It can be seen from Table 3 (Table 3 is a table from the literature [18], where 3 is the table serial number in the literature [18]) that the total number of lines most likely to be attacked are only 4, 4 and 11 for the IEEE 14-bus, 30-bus, and 118-bus power system, respectively. To this end, for the three systems, the total number of multi-classifications are initially determined as 10, 10 and 11, respectively. For the last system, we consider only the case where a physical attack disconnects a single line.

(3)

Design three algorithms for solving the CCPA localization problem via SVM, RF and 1D-CNN approaches, respectively.

The larger the dimensions of a CNN, the more precision there is in regard to the extracted features. But the larger the hyperparameters, the greater the computing power required, and the longer the operating time. The dimensions of the CNN model should be selected according to the actual situation. For example, in the literature [43], a 1D-2D joint CNN was constructed. Although a 1D-CNN can directly conduct convolution processing for the vibration signal, it struggles to make full use of the nonlinear information in the 1D space. As such, Wenliao Du et al. [43] proposed a 1D-2D joint CNN. In the literature [38], because of FLIM data, only temporal decay features need to be evaluated without considering spatial positions, and FLIM data should be treated as a 1D time series. At the same time, a 1D-CNN is faster, and complex matrix operations from high dimensional convolution are replaced by float-point additions and scalar multiplications in 1D-CNNs [38]; as such, a 1D-CNN model was selected. Certainly, starting from how to promote the extracted features’ performance and the generalization ability of the model, we can choose whether the constructed model is mixed or non-mixed. In our works, the data used to extract features are compromised measurements, which is a transposed 2D matrix. In the matrix, each row is actually a row vector, representing a 1D space. Simultaneously, our works have been limited by poor experimental conditions. In brief, we finally construct a 1D-CNN model to solve the problem of CCPA localization.

3. Theory Analysis

3.1. State Estimation & Bad Data Detection

Generally, a graph $\mathcal{G}=(\mathcal{N},\mathcal{L})$ can be used to characterize a power grid. $\mathcal{N}=\{1,\dots ,n\}$ is a set of buses, while $\mathcal{L}=\{1,\dots ,l\}$ indicates the set of transmission lines. A bus is selected as the slack bus. $k=\left\{i,j\right\},i\ne j$ is a line connecting buses i and j. $b_{ij}$ is the line’s susceptance. The voltage phase angle of bus i is represented by ${\theta }_i$. Based on the DC power flow model, the active power flow on line k is shown as $F_{ij}=-b_{ij}({\theta }_i-{\theta }_j)$.

Under the DC power flow model, the system’s state variable is the voltage phase angle $\mathsf{\theta }={({\theta }_1,{\theta }_2,\dots ,{\theta }_{\mathrm{n}})}^T$. When considering $\mathbf{z}\in {\mathbb{R}}^M$, $\mathbf{H}\in {\mathbb{R}}^{M\times (n-1)}$ denote the sensor measurements and the measurement matrix, respectively, and the sensor measurements are shown as follows:

$$\mathbf{z}=\mathbf{H}\mathsf{\theta }+\mathit{e}$$

(3)

where $\mathit{e}$ represents the independent measurement noises that are assumed to be Gaussian. Relying on the weighted least squares (WLS) technique, the estimate of a system state is given as follows:

$$\widehat{\mathsf{\theta }}={\left({\mathbf{H}}^T\mathbf{W}\mathbf{H}\right)}^{-1}{\mathbf{H}}^T\mathbf{W}\mathbf{z}$$

(4)

where $\mathbf{W}$ is a diagonal matrix whose elements are reciprocals of the variances of measurement errors [18]. The measurement residual, denoted by r, is formulated as follows:

$$\mathit{r}=\mathbf{z}-\mathbf{H}\widehat{\mathsf{\theta }}$$

(5)

In bad data detection (BDD), the Euclidean norm of the measurement residual is compared with a predetermined threshold τ. If $\left|\right|{\mathit{r}\left|\right|}_2>$ τ, the BDD will trigger an alarm.

3.2. Coordinated Cyber-Physical Attacks

3.2.1. Undetectable FDIAs

After an FDIA is launched, the compromised measurement is denoted by the following:

$${\mathbf{z}}^{\mathsf{\alpha }}=\mathbf{z}+\mathit{a}$$

(6)

where $\mathit{a}\in {\mathbb{R}}^M$ is an attack vector. If the attack vector follows $\mathit{a}=\mathbf{H}\mathbf{c}$, where c $\in {\mathbb{R}}^{n-1}$, ${\mathbf{z}}^{\mathsf{\alpha }}$ can bypass the BDD [4]. The FDIA is undetectable.

3.2.2. CCPA

A cyber-physical attack (CPA) is a synchronous attack consisting of a physical attack and a cyber-attack. When the physical attack disconnects a subset of the transmission lines, if the cyber-attack is elaborately designed, then the negative effect of the physical attack on the measurement residual can be perfectly masked, which can bypass the BDD. This CPA is stealthy and, as such, is called a CCPA.

The subscript “p” represents the system parameters after a physical attack. After the physical attack is launched, the measurements are denoted as follows:

$${\mathbf{z}}_p=\mathbf{z}+{\mathit{a}}_p=\mathbf{z}+\mathbf{H}\Delta \mathsf{\theta }+\Delta \mathbf{H}{\mathsf{\theta }}_p$$

(7)

where $\Delta \mathbf{H}$ and $\Delta \mathsf{\theta }$ are the change in the measurement matrix and phase angle between post-attack and pre-attack, given by $\Delta \mathbf{H}={\mathbf{H}}_p-\mathbf{H}$ and $\Delta \mathsf{\theta }={\mathsf{\theta }}_p-\mathsf{\theta }$.

Once the effect of the ${\mathit{a}}_p$ on the measurement residual can be eliminated, a CCPA follows. When the CCPA is launched, the compromised measurements are represented as follows:

$${\mathbf{z}}_{ccpa}={\mathbf{z}}_p+{\mathit{a}}_c=\mathbf{z}+\mathbf{H}\Delta \mathsf{\theta }$$

(8)

where $\mathit{a}=-\Delta \mathbf{H}{\mathsf{\theta }}_p$ is a simplest FDIA that can mask the effect of the physical attack.

Actually, the stealthy CCPA (SCCPA) in Formula (8) is called the optimized CCPA [4], also termed as the “partial CCPA” [17]. Nevertheless, there is also one type of stealthy CCPA. The compromised measurements corresponding to the stealthy CCPAs [17] are denoted as follows:

$${\mathbf{z}}_{ccpa\_extra}={\mathbf{z}}_{ccpa}+{\mathit{a}}_{extra}=\mathbf{z}+\mathbf{H}\Delta \mathsf{\theta }+\mathbf{H}\mathbf{c}=\mathbf{z}+\mathbf{H}(\Delta \mathsf{\theta }+\mathbf{c})$$

(9)

3.3. Moving-Target Defense

MTD is a dynamic defense technology that actively perturbs the transmission line reactance settings utilizing D-FACTS devices to invalidate the knowledge grasped by an attacker. The MTD strategy has excellent capabilities to make it exceedingly difficult for the attacker to track the system’s dynamics and collect sufficient information to craft a stealthy CCPA.

3.3.1. D-FACTS Deployment and Operation

Both references [2,8] presented a sufficient condition for the MTD to defend against optimized CCPAs. Essentially, the two conditions are identical. For ensuring the launch of a stealthy CCPA, the attacker must grasp the knowledge of branch reactance within at-least one alternative route between the two ends of the tripped lines [17]. D-FACTS deployment should invalidate the knowledge grasped by the attacker to launch a stealthy CCPA. At least one D-FACTS device is deployed in each alternative path. To find the optimal D-FACTS devices’ deployment, reference [8] proposed an algorithm. Based on the results of reference [8], reference [18] further proposed a more comprehensive algorithm.

The settings of D-FACTS operation are a research hotspot and directly have a vital impact on the MTD defense efficiency. Suppose that a line reactance is x at the initial stage and a D-FACTS device is deployed on the line. We use the subscript “m” to represent system parameters after operating MTD. The line reactance after MTD is $x_m=\lambda x$. $\lambda$ is perturbation ratio. Specifically, the settings of D-FACTS operation are just how to determine $\lambda$ when ensuring the MTD high detection rate. Several references [2,10,18] focus on how to determine $\lambda$. In general, $\lambda \in [0.8 1.2]$ is selected.

3.3.2. CCPA Localization Based on MTD

There are two problems to be clarified in the subsection. The first problem is that we must study which types of stealthy CCPAs are in use. The second problem is why to utilize MTD technology in our work. Formula (8) expresses optimized CCPAs. Yexiang Chen et al. [17] explicitly pointed out that an optimized CCPA (that is a “partial CCPA”) can be directly localized by the CNN without MTD. For the “extra CCPA” denoted by Formula (9), an additional component c (i.e., $\Delta \mathsf{\theta }+\mathit{c}$) is added, which distorts the mapping between $\Delta \mathsf{\theta }$ and the disconnected line. So, in the paper, the “extra CCPA” is the subject of our study. Moreover, the problem of “extra CCPA” localization is studied based on MTD technology. In the rest of this paper, we use the term stealthy CCPA (SCCPA) to substitute for “extra CCPA”.

4. Proposed Method

4.1. Three Algorithms for Solving SCCPAs Localizaiton

In our work, we present three algorithms for solving SCCPAs localization. They are SVM, RF, and CNN, respectively. When applying SVM to solve a multi-class problem, there are three approaches to decouple the multi-class problem: “1-r”, “1-1”, and “1-1-r” [28,30]. In the paper, we select the “1-r” structure. For a k-class problem, “1-r” consists of k-binary classifiers. For every classifier, one class of samples is positive, the remaining are negative samples. RF is one of the most significant classification algorithms [32,33,35] and is an ensemble learning method. An RF consists of multiple decision trees. Each decision tree used as a weak classifier classifies randomly selected features. Through integrating all results from the trees, and the category of the major vote or computed by averaging, the RF outputs the final results. In the paper, the data used to extract features is compromised measurements, which are a 2D transposed matrix. In the matrix, each row is a vector representing a 1D space. Moreover, our works are limited by poor experimental conditions. As such we construct a 1D-CNN model to solve the problem of SCCPA localization.

4.2. Data Sampling Method Design

Data quality is crucial to the data-driven methods. In the paper, we design an algorithm for data sampling, which is described by Figure 1 as follows. In our work, data are the compromised measurements calculated by Formula (2). The MTD perturbation ratio is set between 0.8 and 1.2 (seen in Section 3.3.1), which serves as the outermost cycle condition of the data sampling algorithm. In the case of each specific perturbation ratio, the load profile is randomly changed, which acts as the inner cycle condition. Then, high-quality data are achieved. In the simulations, the quality of these data will be inspected using the XGBoost algorithm. The resulting data are a two-dimensional matrix which belongs to ${\mathbb{R}}^{n\times m}$. The structure of any row of the matrix is shown in Figure 2.

4.3. Algorithm Development of SCCPA Localization Based on SVM

In the paper, we apply the “1-r” structure to conduct the problem of SCCPA localization, and develop an algorithm, namely Algorithm 1, as follows.

Algorithm 1: Conducting the problem of SCCPA localization based on an SVM

Input: The training data $A\in {\mathbb{R}}^{a\times m}$, the training label $\alpha$,     the testing data $B\in {\mathbb{R}}^{b\times m}$, the testing label $\beta ,$ $a+b=n$. Output: Several metrics. 1: for i = 1, 2, …, n do 2:   Extract the data corresponding to label i from $A$ to obtain a new dataset,      denoted as $A1$; 3:   Randomly extract the same amount of data from $A\backslash A1$ to form      another dataset, denoted as $A2$; 4:   Integrate $A1$ and $A2$ to shape a new dataset $C,$ simultaneously,     construct a new column vector (named as $D$) where the elements     corresponding to $A1$ are set as “1” and the elements corresponding     to $A2$ are set as “−1”; 5:     Train the model using C and D. 6: End for 7: for i = 1, 2, …, n do 8:    Prediction with utilizing the trained model and $B$, and then obtain a     matrix, denoted as label_scorei $\in {\mathbb{R}}^{b\times 2}$. 9: End for 10: Construct a new matrix named as score $\in {\mathbb{R}}^{b\times n}$, the i-th column in the score   is the second column of label_scorei. 11: Establish an empty vector final_labels $\in {\mathbb{R}}^{b\times 1}$. 12: for i=1, 2, …, b do 13:   Max function is applied to the i-th row vector in score and obtain the       final prediction label assigned to the i-th element of final_labels. 14: End for 15: Acquire several metrics via $\beta$ and final_labels.

4.4. Algorithm Development of SCCPA Localization Based on RF

In the paper, we also apply RF to solve the problem of SCCPA localization, and develop an algorithm, namely Algorithm 2, as follows.

Algorithm 2: Conducting the problem of SCCPA localization based on an RF

Input: The training data $A\in {\mathbb{R}}^{a\times m}$, the training label $\alpha \in {\mathbb{R}}^{a\times 1}$,     the testing data $B\in {\mathbb{R}}^{b\times m}$, the testing label $\beta \in {\mathbb{R}}^{b\times 1},$ $a+b=n$. Output: Confusion matrix. 1: A is transposed and assigned to the matrix P_train, similarly B is  transposed and assigned to the matrix P_test. 2: $\alpha$ is transposed and assigned to the vector T_train, similarly $\beta$ is  transposed and assigned to the vector T_test. 3: Set a number, denoted as N, and N is equal to b. 4: Normalize P_train and obtain a normalized matrix p_train and the  mapping structure ps_input. 5: Apply mapminmax function to format P_test based on ps_input, and  acquire a matrix p_test. 6: T_train is assigned to a new vector t_train, and T_test is also assigned to a  new vector t_test. 7: p_train, p_test, t_train and t_test are all transposed. After being transposed,  they are the training data formatted, the testing data formatted, the  training label and the testing label, respectively. 8: Set the minimum number of leaves to 1. 9: Apply TreeBagger function to train the model. 10: Apply p_train and the trained model to predict the training label, denoted   as T_sim1, similarly apply p_test and the trained model to predict the   testing label, termed by T_sim2. 11: Apply confusionchart function to obtain a confusion matrix for the   training data based on T_train and T_sim1. 12: Apply confusionchart function to obtain a confusion matrix for the testing   data based on T_test and T_sim2.

4.5. Architecture Design of 1D-CNN

Based on the knowledge of the basic architecture on 1D-CNN, we design a 1D-CNN architecture, as shown in Figure 3, for the problem of SCCPA localization.

5. Simulation

Our simulation results performed with the MATPOWER toolbox are presented below to show the effectiveness of the proposed algorithms. To be more convincing, we performed extensive simulations for IEEE 14-, 30-, and 118-bus power systems.

5.1. Hardware and Softwar Configuration

In general, CNN learning needs considerable computing power and sufficient computing resources. Due to the limited conditions, the hardware configuration in our work is as follows: (1) CPU, Intel Core i7-7700HQ; (2) main frequency, 2.8 GHz; (3) internal memory, RAM, 32GB; (4) operating system, 64-bit Windows 10.

The software configuration is divided into two parts. The first is the software simulation platform embedded within the MATPOWER 7.0 tool; the second part is the PyTorch 2.0 framework based on the Python language.

5.2. Sampled Data Acquisition

The data sampling method has been presented in Section 4.1, as shown in Figure 1. This section describes the acquisition methods of sampled data for IEEE 14-bus, IEEE 30-bus, and IEEE 118-bus power systems, respectively. In addition, the sampling process is generally an internal and external double cycle. However, for acquiring sufficient scale training and test sets, in the inner layer, another layer is added to describe load change scenarios.

5.2.1. Sampled Data Acquisition for the IEEE 14-bus Power System

When considering the full measurement system and the DC power flow model, sensor measurements is a column vector containing 54 elements. The reconstructed set of protected lines is {11, 17, 19, 20} in Ref [18]. Then, the total number of multi-classifications is equal to the number of labels, i.e., 10, which is shown in

Table 2. Labels and corresponding tripping line sets (IEEE 14-bus power system).

Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set
1	11	2	17	3	19	4	20	5	11, 17
6	11, 19	7	11, 20	8	17, 19	9	17, 20	10	19, 20

below. In Table 2, Lab is an abbreviation for label. In the process of the simulation, the number of iterations in the outmost loop is 10, corresponding to 10 different groups of tripping line combinations. The number of iterations in the inner loop is set to 400. The 10th, 18th, and 19th line parameters need to be perturbed. The set of perturbation proportional coefficients is set as [0.8 0.9 0.95 1.05 1.15 1.2]. Additionally, in order to obtain sampled data of sufficient size, during the realistic implementation of data sampling, in the inner cycle, another cycle is added to describe the load change scenarios. In the end, an acquired training dataset may be served as a matrix belonging to ${\mathbb{R}}^{\mathrm{75,200}\times 55}$, and another acquired testing dataset may also be served as a matrix belonging to ${\mathbb{R}}^{4800\times 55}$. In the training dataset, each sample is a row vector containing 55 elements, and the first one is a number representing the label. The same is true for the testing dataset.

5.2.2. Sampled Data Acquisition for the IEEE 30-bus Power System

The method of acquiring sampled data in the IEEE 30-bus power system is basically the same as the above example. The labels and the corresponding tripping line sets are shown in

Table 3. Labels and corresponding tripping line sets (IEEE 30-bus power system).

Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set	Lab	Tripping Line Set
0	17	1	18	2	21	3	22	4	17, 18
5	17, 21	6	11, 22	7	18, 21	8	18, 22	9	21, 22

.

The set of lines perturbed is {15, 20, 23, 26}. The same three-tier loop yields a training dataset, with 75,200 samples and 112 features, and a testing dataset, containing 4800 samples and 112 features.

5.2.3. Sampled Data Acquisition for the IEEE 118-bus Power System

In the IEEE 118-bus power system, the reconstructed set of protected lines is {30, 36, 38, 41, 54, 93, 147, 151, 161, 171, 172}. For the system, we consider a case where one physical attack only disconnects a line, so the total number of multi-classifications equal to the number of labels is 11. Due to the one-to-one relationship, the label implies that the label setting is omitted. After sampling, the training dataset has 82,720 samples and 476 features, while the testing dataset contains 5280 samples and 476 features.

5.3. Sampled Data Quality Inspection

As mentioned above, sampled data quality is very crucial to the data-driven algorithm. In the section, we inspect the quality of sampled data obtained using the XGBoost algorithm. The inspection results are shown in

Table 4. Quality test results of the sampling data using the XGBoost algorithm.

Test Macro	Total Number of Training Sessions	Testing Set Error Rate (Softmax)	Testing Set Error Rate (Softprob)
IEEE 14-bus power system	100	0.0	0.0
IEEE 30-bus power system	100	0.000943	0.000943
IEEE 118-bus power system	100	0.0	0.0

.

In Table 4, “Testing set error rate (softmax)” implies the testing set error rate using the softmax function for multi-classification, while “Testing set error rate (softprob)” implies the testing set error rate using the softprob function for multi-classification. As can be seen from Table 4, for the IEEE 14-bus power system, after 100 training sessions, the testing set error rate using the softmax function is 0, while the testing set error rate using the softprob function is also 0; for the IEEE 30-bus power system, after 100 training sessions, the testing set error rate using the softmax function is 0.0943%, while the testing set error rate using the softprob function is also 0.0943%; for the IEEE 118-bus power system, after 100 training sessions, the testing set error rate using the softmax function is 0, and the testing set error rate using the softprob function is also 0.

In brief, the sampled data acquired are of high quality.

5.4. The Solution for SCCPA Localization via Three Algorithms for the IEEE 14-bus Power System

Firstly, we proposes the specific constructed 1D-CNN architecture shown in Figure 4.

Secondly, we presents three confusion matrices reflecting the results of SCCPA localization based on SVM, RF, and 1D-CNN; these matrices are shown in Figure 5, as follows.

$$P_i=\frac{T{P}_i}{T{P}_i+F{P}_i}$$

(10)

$$R_i=\frac{T{P}_i}{T{P}_i+F{N}_i}$$

(11)

$$F{1}_i=2\times \frac{P_i\times R_i}{P_i+R_i}$$

(12)

At the same time, a comprehensive accuracy evaluation of the system is shown in

Table 5. Model accuracy performance metrics (IEEE 14-bus power system).

Classification	Approach
	SVM			RF			1D-CNN
	P	R	F1	P	R	F1	P	R	F1
1	1	1	1	1	1	1	1	1	1
2	1	1	1	1	1	1	1	1	1
3	1	1	1	1	1	1	1	1	1
4	1	1	1	1	1	1	1	1	1
5	1	1	1	1	1	1	1	0.986	0.993
6	1	1	1	1	1	1	0.982	1	0.99
7	1	1	1	1	1	1	1	1	1
8	1	1	1	1	1	1	1	1	1
9	1	1	1	1	1	1	1	0.987	0.993
10	1	1	1	1	1	1	0.987	1	0.993

.

The diagnostic results of the metrics are shown in

Table 6. Diagnostic results of the metrics (IEEE 14-bus power system).

Approach	Highest-Acc (%)	Minimum-Acc (%)	Avg-Acc (%)	Avg-F1 (%)
SVM	100	100	100	100
RF	100	100	100	100
1D-CNN	100	98.2	99.7	99.7

.

5.5. The Solution for SCCPA Localization via Three Algorithms for the IEEE 30-bus Power System

Similarly, we propose the specific constructed 1D-CNN architecture shown in Figure 6.

Then, we presents three confusion matrices reflecting the results of SCCPA localizations based on SVM, RF, and 1D-CNN; these matrices are shown in Figure 7, as follows.

Certainly, a comprehensive accuracy evaluation of the system is shown in

Table 7. Model accuracy performance metrics (IEEE 30-bus power system).

Classification	Approach
	SVM			RF			1D-CNN
	P	R	F1	P	R	F1	P	R	F1
1	0.552	0.692	0.614	0.996	1	0.998	0.923	1	0.96
2	1	1	1	1	1	1	1	0.998	0.999
3	1	1	1	1	1	1	0.978	0.932	0.95
4	0.595	0.446	0.51	1	1	1	1	0.928	0.96
5	1	1	1	1	1	1	1	0.954	0.977
6	0.9789	0.994	0.986	1	1	1	0.88	1	0.937
7	1	1	1	1	1	1	1	1	1
8	1	1	1	1	1	1	1	1	1
9	1	1	1	1	1	1	0.967	0.92	0.943
10	1	1	1	1	1	1	0.9876	1	0.994

.

A diagnostic results of the metrics is shown in

Table 8. Diagnostic results of the metrics (IEEE 30-bus power system).

Approach	Highest-Acc (%)	Minimum-Acc (%)	Avg-Acc (%)	Avg-F1 (%)
SVM	100	55.2	91.3	91.1
RF	100	99.6	99.96	99.98
1D-CNN	100	88	97.4	97.2

.

5.6. The Solution for SCCPA Localization via Three Algorithms for the IEEE 118-bus Power System

We propose the specific constructed 1D-CNN architecture shown in Figure 8.

Similarly, we presents three confusion matrices reflecting the results of SCCPA localization based on SVM, RF, and 1D-CNN; these matrices are shown in Figure 9, as follows.

For the IEEE 118-bus power system, a comprehensive accuracy evaluation is shown in

Table 9. Model accuracy performance metrics (IEEE 118-bus power system).

Classification	Approach
	SVM			RF			1D-CNN
	P	R	F1	P	R	F1	P	R	F1
1	1	1	1	1	1	1	1	1	1
2	1	1	1	1	1	1	0.992	1	0.996
3	1	1	1	1	1	1	0.981	0.983	0.982
4	1	1	1	1	1	1	1	1	1
5	1	1	1	1	1	1	0.979	0.983	0.981
6	1	1	1	1	1	1	1	0.994	0.997
7	1	1	1	1	1	1	0.985	1	0.992
8	1	1	1	1	1	1	1	0.995	0.998
9	1	1	1	1	1	1	1	0.988	0.993
10	1	1	1	1	1	1	1	1	1
11	1	1	1	1	1	1	0.988	1	0.994

.

For the IEEE 118-bus power system, the diagnostic results of the metrics are shown in

Table 10. Diagnostic results of the metrics (IEEE 118-bus power system).

Approach	Highest-Acc (%)	Minimum-Acc (%)	Avg-Acc (%)	Avg-F1 (%)
SVM	100	100	100	100
RF	100	100	100	100
1D-CNN	100	97.9	97.8	99.4

.

5.7. Experimental Analysis

From the above experimental results, on the whole, the three algorithms have a desirable performance in solving the multi-classification problem of SCCPA localization. The RF’s performance is the best, while the SVM’s performance greatly fluctuates for different systems. In the IEEE 14-bus power system and IEEE 118-bus power system, SVM’s performance is perfect, but in the IEEE 30-bus power system, its representation is barely satisfactory. The performance of 1D-CNN is stable and good. Although the computing power is restricted by practical constraints, the simulation times of the three systems are 236.1 s, 343.5 s, and 931.17 s, respectively, which verifies 1D-CNN’s high efficiency. To suppress the overfitting and to boost generalization ability, we added a dropout layer to the 1D-CNN model in the simulations for the IEEE 30-bus power system and IEEE 118-bus power system. We think that due to the obtained data’s construction, the performance of three algorithms benefits from this step. In our work, these data are the comprised measurements whose transposed row vector is a sample. Moreover, there is also no nonlinear noise interference in the data. This means that features are easily extracted, and that CNN’s powerful convolution computing is not much of an advantage.

6. Discussion

When considering the problem of SCCPA localization, the crucial problem is how to appropriately determine the total number of multi-classifications. Even for a small-scale power system (e.g., the IEEE 14-bus power system), when supposing that the maximum number of tripped lines is 2, there are 210 categories. The enormous total number of classifications greatly restricts the problem of SCCPA localization to be solved. In the paper, through utilizing one of our previous studies [18], the total number of classifications can be simply determined based on the set of transmission lines which are most likely to be attacked. Once the total number of multi-classifications is determined, the SVM and RF algorithms can be easily developed, and the CNN’s architecture is also not difficult to build. Although the time complexity of Algorithm 1 is $\mathcal{O}(n)$ and the time complexity of Algorithm 2 is $\mathcal{O}(1)$, the simulation results can validate the two algorithms are efficient.

In addition, because SVM, RF, and CNN have a strong ability to solve multi-classification problems, in the paper, we only consider using them to conduct the problem of SCCPA localization. Certainly, there are other ML algorithms that can also solve the problem of SCCPA localization.

7. Conclusions

In this paper, the problem of SCCPA localization is deeply studied as a problem of multi-classification. Based on the game theory, the total number of multi-classification is appropriately determined. Moreover, three methods to solve the problem of SCCPA localization are proposed via SVM, RF, and 1D-CNN algorithms. Extensive simulations are carried out for IEEE 14-bus, IEEE 30-bus, and IEEE 118-bus power systems, respectively. The experimental results verify the proposed methods’ correctness and efficiency.